CVE-2024-5333

The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure

The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events.

Affected

The Events Calendar

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

1.12% chance of exploitation in the next 30 days, 66th percentile

Nuclei

medium · CWE-639

Published

2024-12-16

Updated

2025-08-27

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/764b5a23-8b51-4882-b899-beb54f684984/

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5333.yaml

Security advisories

• https://wpscan.com/vulnerability/764b5a23-8b51-4882-b899-beb54f684984

References

• CVE Record
• NVD entry